Employers are required to monitor their employees’ working hours using any means necessary and through an objective, reliable, and accessible system[1]. 

However, this obligation to monitor working hours cannot be exercised without very strict safeguards designed to protect employees’ individual freedoms, as reiterated by the Court of Cassation in its ruling of March 18, 2026 (No. 24-18.976)[2]. 

Based on Article L. 1121-1 of the Labor Code, which states that no one may impose restrictions on the rights of individuals or on individual and collective freedoms that are not justified by the nature of the task to be performed or proportionate to the intended purpose, the Court of Cassation conducts a proportionality review to assess the lawfulness of a geolocation system.

It then dismissed the appeal against an appellate court ruling that had found lawful the geolocation system for employees of the company MEDIAPOSTE, who perform distribution duties, via their Distrio (a smartphone used for distribution).

This ruling provides an opportunity to reiterate the conditions for the lawfulness of geolocation as a mean of monitoring working hours:

Compliance with the principle of subsidiarity: 

Geolocation may be used on the condition that “no other system allows for objective, reliable, and accessible monitoring of these employees’ working hours,” even if it is less effective.

Thus, the Court of Cassation was able to overturn appellate rulings that merely asserted that the system was “the only one possible” without specifically demonstrating the absence of alternative solutions such as badges, schedules, work orders, self-reports, etc[3]. 

In the context of the dispute that gave rise to the March 18, 2026, ruling discussed here, the Court of Appeal of Lyon had specifically held that, given the specific nature of a delivery driver’s work, “monitoring of employees’ distribution activities [could] only be carried out through geolocation” and that no other system allowed for sufficiently reliable monitoring of working hours[4]. 

Limited freedom for employees to organize their work:

The Court of Cassation reiterates here the established principle that the use of a geolocation system to monitor working hours is lawful only when such monitoring cannot be achieved by other means and is not justified when the employee has the freedom to organize their work[5]. 

The Court of Cassation verifies that the trial judges correctly characterized the lack of freedom the employee had in organizing their work[6]. 

In this case, the Court of Appeal of Lyon had indeed noted that the employment contract of the delivery employees granted them only very limited freedom of organization and that their autonomy—which did not extend to the documents to be delivered, their recipients, the route, or the delivery dates—was limited to choosing their working hours during the day. 

Mandatory formalities: 

• Individual notification of employees

Case law reiterates this requirement by stating that “it follows from Articles L. 1222-3 and L. 1222-4 [...] that while the employer has the right to monitor and supervise employees’ activities during working hours, the employer may not use a geolocation system to monitor employees’ activities without first informing them of such monitoring.”[7]. 

This obligation to provide information covers details regarding the identity of the data controller, the purpose of the system, the existence of rights of access, rectification, and objection, and the procedures for exercising these rights. 

• Information and consultation with the CSE

Article L2312-8 of the Labor Code provides, in particular, that the CSE must be informed and consulted regarding: “The introduction of new technologies, any significant changes affecting health and safety conditions or working conditions.” 

This requirement is notably reiterated in the CNIL’s decision of June 4, 2015[8]. 

• A declaration to the CNIL and compliance with the stated purpose

The Metz Court of Appeal has noted that “a geolocation system may not be used [...] for purposes other than those declared to the CNIL and brought to the attention of employees,” failing which the records are unenforceable[9]. 

Employers must also keep in mind the need to establish a reasonable retention period. 

Based on its decision of June 4, 2015, the CNIL considers that a two-month retention period for location data is appropriate for the standard purposes of a geolocation system, with possible extensions in limited circumstances (proof of service, route optimization, etc.), and provides, for the secondary purpose of tracking working hours, a five-year retention period for time data only. 

The Versailles Court of Appeal referred to this standard in determining that a period of two to three months is not excessive in itself, but criticized the lack of effective anonymization of data outside of working hours[10].

• Finally, employee geolocation systems must be recorded in the register required by Article 30 of the GDPR and undergo a prior impact assessment in accordance with Article 35 of the GDPR.

Failure to comply with these conditions exposes the employer to the risk that the geolocation system will be deemed unlawful and therefore unenforceable against employees.  

Consequently, disciplinary sanctions imposed on the basis of this system will be deemed unfounded. 

The employer also risks:

• criminal penalties under Article 226-1 of the Criminal Code (interception, recording, or transmission of a person’s location without their consent)[11]
• and administrative penalties imposed by the CNIL: Article 83 of the GDPR provides that “each supervisory authority shall ensure that administrative fines imposed pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each case, effective, proportionate, and dissuasive.” The amount of such fines may be up to 20,000 euros or 4% of the total worldwide annual turnover of the preceding fiscal year, whichever is higher.

Our firm remains at your disposal to discuss these matters.

[1] Article D3171-8 du code du travail et directive 89/391/CEE du Conseil du 12 juin 1989 et CJUE, 14 mai 2019, Federacion de Servicios de Comisiones Obreras (CCOO), C-55/18, point 60.

[2] Cass, soc, 18 mars 2026 (n°24-18.976).

[3] Cour de cassation, 25 septembre 2024, 22-22.851 

[4] CA Lyon, 25 avril 2024, n° 22/04299.

[5] Cour de cassation, 3 novembre 2011, 10-18.036.

[6] Cour de cassation, 25 septembre 2024, 22-22.851.

[7] Cour de cassation, 6 septembre 2023, 22-12.418.

[8] CNIL, Délibération du 4 juin 2015, n° 2015-165.

[9] CA Metz, 25 janvier 2017, n° 15/03157.

[10] CA Versailles, 29 novembre 2018, n° 17/04328.

[11] Cour de cassation, Chambre criminelle, 23 juin 2015, 14-84.553